PRIVACY POLICY.
Last updated: September 19, 2026
Lootboxly (operating as Lootbox Crate, "we") respects your privacy. This policy explains what personal information we collect on lootboxly.com, why we collect it, how we protect it and what your rights are, in accordance with the Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) and the Personal Information Protection and Electronic Documents Act (Canada).
The person responsible is the owner of Lootboxly. For any question, as well as any request for access, rectification, deletion or withdrawal of consent, write to us at meridiabrand@gmail.com. We reply within a maximum of 30 days.
We do not intentionally collect sensitive information (health, origin, opinions, etc.).
We collect your information with your consent, or where the law allows it, for example to perform the sales contract. Non-essential cookies and technologies (statistics, advertising, profiling) are disabled by default and are only enabled after your consent, which you can change at any time. Commercial communications (newsletter, promotions) are only sent with your consent, in accordance with Canada's Anti-Spam Legislation; every email contains an unsubscribe link. Emails related to your order (confirmation, access, support) continue to be sent.
We do not sell your personal information. Our providers only have access to the information necessary for their mandate and are required to keep it confidential.
Your information may be stored or processed outside Quebec and Canada (notably in the United States) by our providers. Before any transfer, we ensure that the information will receive adequate protection, in accordance with the law.
We keep your information only as long as necessary for the purposes described. Transaction data is kept for 6 years (tax and accounting obligations), then destroyed or anonymized. Marketing data is kept until you withdraw your consent. Your customer account is kept until you request its deletion, subject to our legal obligations.
We use reasonable measures: HTTPS connection, restricted access, a PCI-DSS compliant platform for payments. As no method is foolproof, in the event of a confidentiality incident presenting a risk of serious harm, we will notify the Commission d'accès à l'information and the individuals concerned.
We do not make any decision based exclusively on automated processing of your information. To exercise your rights, write to us at meridiabrand@gmail.com. We may need to verify your identity. Exercising your rights is free of charge.
You may first write to us to resolve the situation. You may also file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
Our products and services are intended for people aged 18 and over. We do not knowingly collect information about minors. If we learn that we have, we will delete it.
European Union and United Kingdom (GDPR): we process your data to perform the contract, meet our legal obligations, based on our legitimate interest (security, fraud prevention) or with your consent. You also have the rights to object and to restrict processing, and may file a complaint with your supervisory authority. California (CCPA/CPRA):we do not sell personal information. You may request access, correction or deletion of your data, and opt out of sharing for targeted advertising, by writing to us.
We may update this policy. The update date appears at the top of the page. In the event of a significant change, we will let you know.
Lootboxly (Lootbox Crate) — Montreal, Quebec, Canada — meridiabrand@gmail.com. See also our Terms and Conditions and our Cookie Policy..